Re: The real problem that https has conspicuously failed to fix

[Jeffrey I. Schiller]

Oh, and btw, the form posting URL in my message wasn't even https, it was just http. So all the futzing in the world with https wouldn't help!

-Jeff

Pete Chown wrote:

John R. Levine wrote:

Crypto lets someone say "Hi!  I absolutely definitely
have a name somewhat like the name of a large familiar organization,
and I'd like to steal your data!" ...

It might help if browsers displayed some details of the certificate without being asked. For example, instead of a padlock, the browser could have an SSL toolbar. This would show the verified name and address of the site you are connected to.

The bar could also show the server name for unverified connections. This would avoid the attacks that use URLs like http://www.microsoft.com:[EMAIL PROTECTED] .

pgp00000.pgp

Description: PGP signature